Kipis.B - Unhappy New Years

Recently I wrote about two worms (here and here) that promised to make Christmas a little less merry for the unlucky souls who fell for their festive email-based tricks. For New Years, a worm by the name of Kipis.B appeared a week ago and McAfee has just now posted a description of it. The fact that McAfee decided to wait a week before publishing the description is a good indication that so far, Kipis.B is not much of an issue. However, it is worth taking a look at it as a good example of a bare-bones holiday email worm.

Kipis.B, like most recent email worms, contains it own mailing engine, sends itself under the names of other people. These may include email addresses such as madonna@madonna.com, in addition to other emails suggesting female  pop artists. The subject is either a swear word, “Happy New Year,“ or “Hello.“ The email can vary, either consisting of a fake server error message, a somewhat offensive phrase, or “Hello! baby :)”. The attachment varies, but always ends with .scr.

It should be noted that the worm will not always send itself with a New Years message; only one of the email subjects mentions New Years, while two of the attachments contain “03” or “04” in their filenames. The worm also can spread itself via P2P shared folders, usually using filenames suggesting pornographic content or illegal files (”warez.”)

The worm will not email itself to certain addresses, mainly consisting of antivirus sites, files that may be confused with emails (it won't send to any email containing “.txt” for instance), as well as various technology web sites and other minor web sites of unknown reason for not mailing to. Most of these minor web sites are located in Russia or are associated with the Russian language, suggesting that this worm may originate from there.

At this time, I haven't heard of any reports about this worm spreading significantly. However, as it is not themed after New Years in many instances, there is a small possibility of this worm appearing in the field after New Years.